A novel OAuth Client ID spoofing technique is on the rise, targeting cloud environments, as revealed by Proofpoint's research. Attackers exploit Microsoft's Entra ID to spoof OAuth Client IDs to gain unauthorized access to accounts without registered IDs. This stealthy method makes it challenging for cybersecurity teams to detect suspicious activities, as the logs often appear normal due to blank fields.
The research highlights that multiple large-scale campaigns are utilizing this technique, potentially impacting millions of accounts. Organizations are advised to treat suspicious log entries without corresponding application names as potential indicators of spoofing and to remain vigilant against compromised credentials.